PydanticAI v1.107.9 修复 web_fetch HTML 转换高危问题

AI 摘要

PydanticAI 发布 v1.107.9，修复了 web_fetch_tool 中的一个高危安全问题（GHSA-4whf-38hw-pxxh）：当该工具抓取攻击者控制的、包含大量元素的 HTML 时，HTML 转换过程可能阻塞同一进程内的其他任务。该问题已在 v2.59.0 和 v1.107.9 中修复，官方建议能够抓取此类页面的用户升级。

正文节选

> This comment was posted by Codex Desktop using gpt-6.1-sol on behalf of David. ## What's Changed ### 🛡️ Security * **High — HTML conversion in `web_fetch`:** [GHSA-4whf-38hw-pxxh](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-4whf-38hw-pxxh). When `web_fetch_tool` fetched attacker-controlled HTML containing many elements, conversion could delay unrelated work in the same process. Fixed in v2.59.0 and v1.107.9. Upgrade if the tool can fetch such pages. **Full Changelog**:

发布时间：2026-10-21 12:36

抓取时间：2026-10-21 12:46

来源机构：Pydantic